store: remove uses of docker namesgenerator

[thaJeztah]

It will not be part of the api or client modules, so replace it with a local implementation, that's not using names of hackers/scientists, so that we don't have to carry the debates around those choices here.

Thanks to ChatGPT for generating some lists (I haven't fully checked them).

[thaJeztah]

@crazy-max PTAL

[crazy-max]

Thanks to ChatGPT for generating some lists (I haven't fully checked them).

Asked Copilot about this list:

Reviewing the provided lists of adjectives and nouns, I do not see any words that are widely considered controversial, offensive, or inappropriate in general English usage. The words are fairly neutral and commonly found in random name generators for things like containers or temporary objects.

However, a few things to consider:

• "Lazy" and "odd" (adjectives) can carry slightly negative connotations (e.g., describing something as lazy or odd), but they are not offensive.
• Some words could be interpreted as negative depending on the context, such as "void," "crash," "shock," "crash," "void," "crash," or "null" (though "null" is not in your list, "void" and "crash" are).
• "Blank" might be interpreted negatively in some contexts.
• There are no slurs, profanities, or terms with cultural or historical baggage.

If you are especially concerned about user sensitivity or brand image, you may wish to review or filter out words that could be perceived as negative or unprofessional in some combinations (e.g., "lazy-crash" or "odd-void"), even though none are inherently controversial.

[thaJeztah]

LOL fight of the AI - ChatGPT created the list.

I'll probably split the list to 1 word per line; easier to add/remove things and to spot duplicates.

Will update in a bit

[thaJeztah]

Oh! Need to remove those words it flagged as possibly offensive. Funny because I told ChatGPT to take that into account but already noticed it didn't do a great job

[crazy-max]

Oh! Need to remove those words it flagged as possibly offensive. Funny because I told ChatGPT to take that into account but already noticed it didn't do a great job

Yeah might not be the same model

[thaJeztah]

Oh! Let me check those last comments from CoPilot, LOL, I thought "let me put AI to use for silly tasks like generating a unique list", and it failed miserably every time.

[thaJeztah]

Updated the list

[Copilot]

Pull Request Overview

This PR replaces the Docker namesgenerator dependency with a local implementation to avoid carrying debates around the choice of names (hackers/scientists) used in the Docker package. The change maintains the same random name generation functionality while using neutral adjectives, nouns, and themes.

• Removes external dependency on github.com/docker/docker/pkg/namesgenerator
• Implements local name generation using three word lists (adjectives, nouns, themes)
• Updates the random number generation to use math/rand/v2

Reviewed Changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 2 comments.

File	Description
store/util.go	Updates name generation logic to use local word lists and new random API
store/random_names.go	Adds three word lists for generating random names with neutral vocabulary

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[jsternberg]

I think my understanding of where this issue landed was that @tonistiigi didn't want us to have a separate names generator or maintain separate code for buildx. I propose that either we close this PR or that we move this new names generator into the docker/cli repository or moby/sys. If it's in either of those, I think we can use those as dependencies.

[thaJeztah]

The "notable names" based generator will be sunset entirely, and won't be a separate module; moby/moby#52097

But I still wonder if buildx should use a different naming altogether for builders; see #3326 (comment)

We may have something like this (just a really quick write-up without giving it much thought);

docker buildx ls
CONTEXT/INSTANCE DRIVER STATUS BUILDKIT PLATFORMS
desktop-linux *\_ desktop-linux docker running v0.25.1 linux/amd64 (+2), linux/arm64, linux/ppc64le, linux/s390x, (2 more)
\_ desktop-linux0 docker-container error
\_ desktop-linux1 docker-container inactive

I'm not 100% sure what the exact use-cases are for multiple builders per context; I could see this being to namespace builds, but (see my earlier comment), perhaps that's something we should look into in a wider scope to namespace objects (containers, volumes, builders, networks).

[jsternberg]

@tonistiigi would you be ok if I resolved this by removing any random namesgenerator to begin with and change the naming to be ${driver}-${rand} or something similar to one of the proposals in moby? Then we can avoid any names generator to begin with.

[egorman-sray]

hey @thaJeztah is this PR still being considered?

You were right on this issue #3792 that the CVEs are false positives, but this namesgenerator is the only remaining case that imports from the old module, and it would make our security scanning software much happier to remove it 😅

if you could merge this soon that would be greatly appreciated! though i understand it's been a few months and there are merge conflicts for this work now

edit: or alternatively the other PR mentioned here #3813 ?

[kostyay]

Hey
It would be great to get this merged.
Fix the CVE false positive